LexLint.ioBeta

Know the law your code answers to.

Law / Malawi

Data Protection Act, 2024, notification of personal data breach

Data Protection Act, 2024, ss. 36-37 (notification of personal data breach)

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://macra.mw/download/25/rulesregulations/252806/data-protection-act-2024.pdf

In force since .

A breach notification rule binding public and private bodies.

Obligation class
Breach notice, Disclosure
Audit expectation
none

What it requires

  • Notify the Authority of a personal data breach within seventy-two hours of becoming aware of it, describing the nature of the breach, where possible the categories of personal data and the number of data subjects affected, its likely consequences, the measures taken or proposed, and the name and contact details of your data protection officer.
  • Where you cannot give all of that information within seventy-two hours, provide it as soon as it becomes available.
  • Keep a record of each personal data breach and of the information the notification to the Authority must include.
  • If you are a data processor, notify the data controller of a personal data breach within seventy-two hours of becoming aware of it, with the particulars the notification to the Authority must include.
  • Where a personal data breach is of high risk to the rights and freedoms of a data subject, notify the data subject within seventy-two hours of becoming aware of the breach, describing the nature of the breach, its likely consequence and the measures taken or proposed.
  • Where notifying the data subject involves a disproportionate effort or expense, make a public notification in at least one newspaper of wide circulation in Malawi and any other mode of communication you consider appropriate.

These lines are LexLint's reading of the law's text.

What it makes you log

Logging duty

Section 36(4) requires a data controller to keep a record of each personal data breach and of the information the notification to the Authority must include, which section 36(2) lists as the nature of the breach, the categories of data and number of data subjects where possible, its likely consequences, the measures taken or proposed and the data protection officer's details. The record fields are descriptive and match none of the listed log-content values. The section sets no retention period and names no one entitled to see the record. The seventy-two hour notices in sections 36 and 37 are reports sent out and are not themselves a record. The row cites no territorial clause, so no hook is read.

Kind
Explicit
As of
Provision
Data Protection Act, 2024, section 36(4)
Trigger
security_incident

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 2 defines a personal data breach as a breach of data security leading to, or likely to lead to, unauthorized disclosure of, or access to, or loss, alteration or accidental or unlawful destruction of personal data transmitted, stored or otherwise processed by the data controller or data processor. Section 36(1) requires a data controller, in the case of a personal data breach, to notify the Authority within seventy-two hours of becoming aware of the breach.

Section 36(2) requires the notification to the Authority to describe the nature of the breach, the categories of personal data and the number of data subjects affected where possible, the likely consequences, the measures taken or proposed, and the name and contact details of the data protection officer. Section 36(3) requires the data controller to provide that information as soon as it becomes available where it is not practically possible to provide it within seventy-two hours.

Section 36(4) requires a data controller to keep a record of each personal data breach and of the information the notification must include. Section 36(5) requires a data processor to notify the data controller of a personal data breach within seventy-two hours of becoming aware of the breach. Section 36(6) requires the data processor's notification to contain the particulars prescribed under section 36(2).

Section 37(1) requires a data controller to notify the data subject of a personal data breach that is of high risk to the rights and freedoms of the data subject within seventy-two hours of becoming aware of the breach. Section 37(3) requires that notification to describe the nature of the breach, its likely consequence and the measures taken or proposed to address it.

Section 37(4) requires a data controller to make a public notification in at least one newspaper of wide circulation in Malawi and any other mode of communication it considers appropriate where notifying the data subject involves a disproportionate effort or expense. A notice of commencement published in the Malawi Gazette Supplement of appointed as the date on which the Data Protection Act, 2024 came into operation.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .